CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 allows an attacker to place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
In InsydeH2O Kernel 5.0 through 5.4 before specific versions, a stack-based buffer overflow in the UEFI DisplayTypeDxe DXE driver can lead to arbitrary code execution.
Reflected XSS vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below. Attacker-controlled input is reflected back in the page without sanitization.
SQL Injection vulnerability in PrinterLogic Web Stack versions 19.1.1.13 SP9 and below allows an attacker to inject malicious SQL code, potentially gaining unauthorized access to additional audit records.
A reflected XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
The Apache Xerces Java (XercesJ) XML parser in version 2.12.1 and earlier is vulnerable to an infinite loop when handling specially crafted XML document payloads. This may cause the parser to wait indefinitely, potentially consuming system resources for a prolonged duration.
Reprise License Manager 14.2 is affected by a reflected XSS vulnerability in the 'count' parameter of the /goform/activate_process endpoint. No authentication is required.
W wersji 1.4.0 Trusted Firmware-M (TF-M) przy użyciu profilu Small występuje nieprawidłowa kontrola dostępu. NSPE może uzyskać dostęp do zabezpieczonego klucza (przechowywanego przez usługę Crypto) jedynie na podstawie znajomości jego identyfikatora klucza.
An improper check or handling of exceptional conditions in the NPU driver allows arbitrary memory write and code execution.
The Serv-U web login screen for LDAP authentication allowed characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization.
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read files outside of the restricted directory.
Wersje Apache Log4j2 od 2.0-beta7 do 2.17.0 (z wyłączeniem poprawek bezpieczeństwa 2.3.2 i 2.12.4) są podatne na atak zdalnego wykonania kodu (RCE) przy użyciu konfiguracji z JDBC Appender i źródłem danych JNDI LDAP, gdy atakujący ma kontrolę nad docelowym serwerem LDAP. Problem został rozwiązany poprzez ograniczenie nazw źródeł danych JNDI do protokołu java w wersjach Log4j2 2.17.1, 2.12.4 i 2.3.2.
A cross-site scripting (XSS) vulnerability was found in S-CMS Government Station Building System v5.0 in the /function/booksave.php file. It allows an attacker to inject malicious client-side scripts.
A cross-site scripting (XSS) vulnerability was found in the search function of S-CMS Government Station Building System v5.0. It allows injection of malicious JavaScript code into the page.
Wersje Apache Log4j2 od 2.0-alpha1 do 2.16.0 (z wyjątkiem 2.12.3 i 2.3.1) nie chroniły przed niekontrolowaną rekurencją w przypadku samoodwołujących się wyszukiwań. Umożliwia to atakującemu, który ma kontrolę nad danymi w Thread Context Map, spowodowanie odmowy usługi podczas interpretacji spreparowanego ciągu.
In unix_scm_to_skb of af_unix.c, there is a possible use-after-free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed.
Verint Workforce Optimization (WFO) version 15.2.8.10048 is vulnerable to Cross-Site Scripting (XSS) via the NEWUINAV parameter in the control/my_notifications endpoint. An attacker can inject malicious JavaScript code that executes in the victim's browser.
A cross-site scripting (XSS) vulnerability was found in Genesys Workforce Management 8.5.214.20 during record deletion via the Time-off parameter. An attacker can inject a malicious script that executes in the victim's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS